feat(desktop): add exact-target normal application quit

[iamnbutler]

Adds desktop_quit for one exact running application from desktop_apps. The native bridge requests normal quit with the observed PID and process generation and never force-quits or retries. Confirmed termination returns completed; an accepted request that leaves the application running returns unknown and refreshed application/window inventory, so the agent can inspect unsaved-work dialogs deliberately. Later inventory cannot change the recorded quit outcome.

A focused patch to pinned Peekaboo preserves accepted but unfinished normal quit as one dispatched operation with unsafe retry. Its quit-specific result validator permits this uncertain outcome with false termination, allowing the existing bridge to retain the signed process receipt instead of rejecting the result. Other contradictory outcomes and force-quit behavior stay unchanged.

Part of #8.

Validated on 086c9c4, including current main's #120 and #131:

• bun types, bun run ci, git diff --check, signed bun desktop build dev, and strict signature verification passed. Independent source and validation-driver reviews found no blocker.
• Stale-generation and pre-cancelled requests were refused before the real AppKit fixture received a quit callback. Normal quit with a deferred save sheet produced exactly one callback and unknown, terminated: false, unsafe retry, and the exact receipt with fresh windows.
• A real gpt-6-sol channel used desktop_quit once to terminate the normal fixture. The completed result retained terminated: true when later inventory returned no application.
• Closing and reopening the same durable channel kept the exact result and recorded usage, with no new provider response or tool execution. All owned fixtures, app, host, and workers exited; the temporary channel and project were removed.

Built in Ace

Used Codex for source editing, terminal work, independent review, and validation orchestration under Nate's explicit temporary exception to the Ace-only workflow. Ace did not yet expose the native quit capability being implemented, and this exception allows work on the computer-use gaps in #8 and #5. The real model check ran through Ace's actual source host, channel worker, signed desktop bridge, and durable store. Desktop checks used a coordinated slot and disposable public fixtures.